Tweet
When an attacker is doing a social engineering attack over the phone a third person can be helpful.
What the attacker will do is call a person that is in the possession of something the attacker needs then pretend to be in a bad situation like being late with a report or any other information that needs to be delivered to a manager, CTO or similar. The attacker is playing on the fact that it is human nature to help a colleague in need and attempt to sound desperate. Here is where the third person comes in. To amplify the attack the third person will stand in the background of the call and yell about the seemingly missing report. The attacker will make sure the target will hear the yelling and demanding in the background. This may entice the victim to comply with the demand of the attacker and do some helpful task or deliver some information she shouldn't do.
Obviously this can be used in various ways as long as it fits the scene the attacker is attempting to play out.
What the attacker will do is call a person that is in the possession of something the attacker needs then pretend to be in a bad situation like being late with a report or any other information that needs to be delivered to a manager, CTO or similar. The attacker is playing on the fact that it is human nature to help a colleague in need and attempt to sound desperate. Here is where the third person comes in. To amplify the attack the third person will stand in the background of the call and yell about the seemingly missing report. The attacker will make sure the target will hear the yelling and demanding in the background. This may entice the victim to comply with the demand of the attacker and do some helpful task or deliver some information she shouldn't do.
Obviously this can be used in various ways as long as it fits the scene the attacker is attempting to play out.